CVE-2026-43470: Linux Kernel Race Condition Vulnerability

CVE-2026-43470 Overview

CVE-2026-43470 is a Linux kernel vulnerability in the Network File System version 3 (NFSv3) client code. The flaw resides in the nfs3_proc_create create path, where the kernel fails to handle directory dentry aliases returned from d_splice_alias. When nfs3_do_create and nfs_add_or_obtain encounter a directory alias, the function discards the alias without propagating an error, leaving the original dentry in a negative state. A subsequent call to nfs_atomic_open_v23 and finish_open then operates on this negative dentry, triggering a kernel oops. The issue was observed under lustre-racer workloads where files and directories are created and removed concurrently with the same name without O_EXCL.

Critical Impact
A local attacker performing concurrent NFSv3 file and directory operations with conflicting names can trigger a kernel oops, resulting in denial of service on the affected host.

Affected Products

Linux kernel NFSv3 client subsystem (fs/nfs/nfs3proc.c)
Stable kernel branches receiving patches 203c792, 410666a, 7e29637, and 9ee1770
Systems mounting NFSv3 shares with concurrent same-name create and remove workloads

Discovery Timeline

2026-05-08 - CVE-2026-43470 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43470

Vulnerability Analysis

The vulnerability is a null pointer dereference triggered by improper handling of directory aliases during NFSv3 file creation. The nfs3_proc_create function calls nfs3_do_create and nfs_add_or_obtain, which in turn invoke d_splice_alias to attach an inode to a dentry. When d_splice_alias returns an existing dentry that happens to be a directory, the calling code silently discards the alias and returns success. The original dentry passed in by the caller, however, remains negative — it has no associated inode.

Control flow continues into nfs_atomic_open_v23, which forwards the still-negative dentry to finish_open. The downstream code expects a positive dentry and dereferences fields that point to invalid memory, producing a kernel oops.

The race window is reachable through the lustre-racer workload, which performs concurrent create and unlink operations against the same names without using O_EXCL. This pattern is plausible in any multi-client NFS deployment where applications race on shared paths.

Root Cause

The root cause is missing validation of the alias type returned by d_splice_alias. The fix introduces an explicit d_is_dir() check and returns -EISDIR when a directory alias is encountered, preventing file open routines from operating on a directory inode.

Attack Vector

Exploitation requires local access to a host with an NFSv3 mount and the ability to issue concurrent create and remove operations against the same path. No authentication beyond standard filesystem access is required. The outcome is a kernel oops and denial of service rather than code execution or privilege escalation.

No public proof-of-concept exploit code is available. The vulnerability is described in prose by the upstream kernel commits referenced below. See the Kernel Patch Change 203c792 for the source-level fix.

Detection Methods for CVE-2026-43470

Indicators of Compromise

Kernel oops messages in dmesg or /var/log/kern.log referencing finish_open, nfs_atomic_open_v23, or do_dentry_open
Unexpected NFS client process crashes or hangs during concurrent file create and unlink workloads
Stack traces pointing into nfs3_proc_create, nfs3_do_create, or nfs_add_or_obtain

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference panics originating in the NFS client path
Audit hosts running kernels predating the 203c792, 410666a, 7e29637, or 9ee1770 commits where NFSv3 mounts are in use
Correlate application-level errors on NFSv3 clients with kernel crash timestamps to identify exposure

Monitoring Recommendations

Forward kernel logs from NFSv3 client hosts to a centralized logging or SIEM platform for oops pattern matching
Track kernel version inventory across the fleet and flag systems running unpatched NFSv3-enabled builds
Alert on repeated NFS client crashes that may indicate active triggering of the race condition

How to Mitigate CVE-2026-43470

Immediate Actions Required

Apply the stable kernel update containing commits 203c792, 410666a, 7e29637, or 9ee1770 as appropriate for your branch
Identify hosts mounting NFSv3 shares and prioritize them for kernel patching
Where possible, migrate NFSv3 mounts to NFSv4, which uses a different create path not affected by this issue

Patch Information

The upstream fix adds an explicit d_is_dir() check in nfs3_proc_create so that the function returns -EISDIR when d_splice_alias yields a directory alias. Patches are available in the stable tree at Kernel Patch Change 410666a, Kernel Patch Change 7e29637, and Kernel Patch Change 9ee1770. Rebuild and reboot affected hosts after applying the patch.

Workarounds

Avoid workloads that concurrently create and remove files and directories sharing the same name on NFSv3 mounts
Open files with the O_EXCL flag where application logic permits, eliminating the race condition path
Switch shared filesystems to NFSv4 until kernel patches can be deployed

bash

# Verify the running kernel and check for the fix
uname -r
# Inspect mounted NFS versions to identify exposed clients
mount -t nfs,nfs4 | awk '{print $1, $3, $5}'
# Example: remount a share using NFSv4 as a temporary mitigation
mount -o remount,vers=4 /mnt/share